# Bash Capability Map — v0.9 (grill C-18)

Maps every capability in the shipped `internal/transport` package to its
bash-side equivalent (or accepted drop with recorded rationale) in the v0.9
re-architecture. The grill (C-18) required this mapping so capability
regressions are visible, not silent.

| Shipped capability (internal/transport) | Bash-side equivalent | Status | Rationale |
|---|---|---|---|
| Retry with exponential backoff (`retry.go`: 100ms start, ×2, cap 5s, max 5 attempts) | `orca-retry()` function in `scripts/lib/orca-retry.sh` (to be written in v0.9-P01 SSH-push transport phase, REQ-073) | **planned** (v0.9-P01) | SSH dial/exec failures need the same bounded retry. The pattern is transport-agnostic; the Go retry logic is extracted into the new `internal/sshpush/` package and a bash-side helper mirrors it for the lead-applier scripts. |
| Idempotency keys (`idempotency.go`: in-memory `sync.Map` of keys, `X-Orca-Idempotency-Key` header) | Content-addressed filenames — skip SCP if the target hash already exists on the peer | **planned** (v0.9-P01) | SSH-push doesn't have HTTP headers; idempotency is achieved by content-addressing the rendered file (`<hash>.unit`) and skipping if the peer already has it. The bash applier checks `test -f /run/orca/<hash>` before applying. |
| Structured mTLS failure logging (`handshake_log.go`: slog JSON per mTLS failure) | `orca_log_error` via `scripts/lib/orca-log.sh` (C-17, shipped in this phase P00) | **dropped (mTLS removed by R-001)** | The v0.9 re-architecture removes mTLS daemon-to-daemon transport entirely (R-001). SSH failures are logged via the new `orca_log_*` functions which emit the same slog-compatible JSON field set (ts, level, actor, action, resource, result, error) to syslog. The mTLS-specific handshake-log fields (cipher suite, TLS version, cert SAN) have no SSH equivalent and are dropped — the SSH error message is captured in the `error` field instead. |
| TLS 1.3 + AEAD cipher allowlist (`mtls.go`: MinVersion=tls.VersionTLS13, CipherSuites limited) | SSH's own cipher config (`/etc/ssh/sshd_config` `Ciphers`, `MACs`, `KexAlgorithms`) managed by the operator | **dropped (transport replaced)** | R-001 replaces mTLS HTTP with SSH. SSH's transport security is governed by the peer's sshd_config, not the orca binary. The CLI's SSH client (`golang.org/x/crypto/ssh`, already a dep) uses Go's default modern SSH cipher set. The PRD does not require orca to manage sshd_config cipher policy in v0.9. |
| mTLS client/server handshake (`mtls.go`: `MTLSClient`, daemon-side `SubmitHandler`) | `ssh.Dial` + `ssh.PublicKeys` auth (CLI-side `internal/sshpush/`, REQ-073) | **replaced** (v0.9-P01) | The daemon-to-daemon mTLS handshake is replaced by CLI-to-server SSH. The CLI holds an Ed25519 key (`cluster/orca_ssh_key`, D-037) and authenticates to each peer's sshd. TOFU host-key handling (`proxmox.TOFUHostKeyCallback`, v0.8 REQ-058) is reused for all peers, not just Proxmox. |

## Net-new capabilities in v0.9 (no shipped equivalent)

| Net-new capability | Bash-side | Status |
|---|---|---|
| Transaction bundle apply (R-010, REQ-075) | `orca-apply-render.sh` (v0.10-P10) | planned |
| Drift detection (R-010) | `orca-drift.sh` (v0.10-P10) | planned |
| Per-node state collection | `orca-collect.sh` (v0.10-P09) | planned |
| Lead aggregation | `orca-aggregate.sh` (v0.10-P09) | planned |
| Credential cleanup (5-min shred) | `orca-cleanup-credentials.sh` (v0.10) | planned |
| Render-bundle validation (C-16) | `orca-verify-render.sh` (shipped this phase P00) | ✅ shipped |
| Structured logging (C-17) | `orca-log.sh` (shipped this phase P00) | ✅ shipped |

## Review cadence

This map is reviewed at each phase that introduces or modifies a bash
script. The security-engineer persona reviews the SSH trust surface; the
devops-engineer persona reviews the bash tooling gate (C-15..C-18).